dhi.io/gitlab-runner
GitLab Runner 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:aa645308bd9191b8d344d8e2d7053f9deb4b94362df5473016972322a97f996f
Manifest digest:sha256:aea571e9790e44cc9c8d7e04187873f2afccbbd1d5ad95754e46c8fb58bb07f8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:15521f0aab8fa78441248e020c3302a8d25b5e5eab358f2d871a31e02a23111b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:99533e783f1b84be60e1c7d01dad6f8420539f40fe77211542b9e11a49151432 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:fee7f68b0e6716d3e01079a0d9b90fe0b272c2d15e24804921b61cd878861c1f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:fd4418989800c033f324a1e3c00c45d3a44608419227c315e177b6cb05ef2eaf |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:a57319181241b7ae688dabc1f1d574bc5eb42f6ae06f132b647b0cd226e99d25 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:0d6d036eed6ed91bebd911a25131b445895252ad36753fd75941fac44b61d2cd |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:71d3f102e0a2f67d8b6f963a5c1322a23fd5b3b4f6391a436fadf31ec12cc9fe |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:87f59b86cb2b64208ed8456c749507ac2da396e95b9e0fbdae6bd41c9625c9a8 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:61138434b88b0534d322b16e357088a28415798553650cf35644e89b1143076d |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:a66ff17c516ffe1a99d2a741d58f006158baf5bfa80f3f48285294a1932de47f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:02628ad29a8e39f11148923330434da65796411f516e211c19758e2316309848 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:8a765eb8e3b3ae7211f721d1e800479fd3810f9af69bcdaae3f589a9e6b08f6b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:110febc5a16cb5c8156bbb5b159d428a4eeed455262bce921d3e6d5998c38cc1 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:507f1dcd84064d30a8ff9209a2a95334b575fb8cfae2abc4b7c15c65c5dcf62d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:30507248e46025a5228b22df398bbab622dfd91e030eb88d947d1e7b18cc9a3b |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:c24baa8a8b6b5ea54070bf42c6e09be7cd41f76b17c2aee384fd9f94959edfce |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:a30a0b4c4de8a9421059e8493ee6bea0712d9f8b495dd0732b6b7229352d9ece |